00-depot: add persistent Loki Alloy Grafana stack

logging/alloy-config.alloy

@@ -0,0 +1,65 @@
+// Direct replacement for the old syslog-ng -> Promtail -> Loki path.
+//
+// Existing RouterOS senders target 185.108.4.158:514/udp and use classic
+// BSD/RFC3164 framing. TCP/601 is retained for RFC5424-capable senders.
+
+loki.relabel "syslog" {
+  forward_to = []
+
+  // Preserve the label used by the existing history and MikroTik dashboard.
+  rule {
+    source_labels = ["__syslog_message_hostname"]
+    target_label  = "routerboard"
+  }
+
+  rule {
+    source_labels = ["__syslog_message_severity"]
+    target_label  = "severity"
+  }
+
+  rule {
+    source_labels = ["__syslog_message_facility"]
+    target_label  = "facility"
+  }
+
+  rule {
+    source_labels = ["__syslog_connection_ip_address"]
+    target_label  = "source_ip"
+  }
+}
+
+loki.source.syslog "network_devices_udp" {
+  listener {
+    address       = "0.0.0.0:514"
+    protocol      = "udp"
+    syslog_format = "rfc3164"
+    labels = {
+      job       = "syslog",
+      transport = "udp",
+    }
+  }
+
+  relabel_rules = loki.relabel.syslog.rules
+  forward_to    = [loki.write.default.receiver]
+}
+
+loki.source.syslog "network_devices_tcp" {
+  listener {
+    address       = "0.0.0.0:601"
+    protocol      = "tcp"
+    syslog_format = "rfc5424"
+    labels = {
+      job       = "syslog",
+      transport = "tcp",
+    }
+  }
+
+  relabel_rules = loki.relabel.syslog.rules
+  forward_to    = [loki.write.default.receiver]
+}
+
+loki.write "default" {
+  endpoint {
+    url = "http://loki:3100/loki/api/v1/push"
+  }
+}